{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-23242",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-23242"
  ],
  "published": "2026-03-18T10:05:24Z",
  "summary": "RDMA/siw: Fix potential NULL pointer dereference in header processing",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix potential NULL pointer dereference in header processing\n\nIf siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(),\nqp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data()\ndereferences qp->rx_fpdu->more_ddp_segs without checking, which\nmay lead to a NULL pointer deref. Only check more_ddp_segs when\nrx_fpdu is present.\n\nKASAN splat:\n[  101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]\n[  101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.165",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23242"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ab61841633d10e56a58c1493a262f0d02dba2f5e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8564dcc12fbb372d984ab45768cae9335777b274"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ab957056192d6bd068b3759cb2077d859cca01f0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ffba40b67663567481fa8a1ed5d2da36897c175d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/87b7a036d2c73d5bb3ae2d47dee23de465db3355"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/714c99e1dc8f85f446e05be02ba83972e981a817"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ce025f7f5d070596194315eb2e4e89d568b8a755"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/14ab3da122bd18920ad57428f6cf4fade8385142"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T13:16:28Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.5,
      "cvss_v3_severity": "High",
      "scenario": "AV:N - SIW (Software iWARP) operates over TCP connections. A remote RDMA peer can send malformed DDP/RDMAP packets with invalid version or opcode fields to trigger the NULL pointer dereference in the TCP receive callback siw_tcp_rx_data().\nAC:L - The attacker can reliably trigger the bug by sending a malformed DDP packet with an invalid version or opcode field after establishing the TCP/RDMA connection. No race condition or special conditions required.\nPR:N - The vulnerability is triggered during iWARP protocol message processing from a connected TCP peer. While an RDMA connection must be established first, this is part of the network protocol and does not require authentication credentials \u2014 any peer that can connect to the SIW port can trigger this.\nUI:N - No user interaction is required. The attacker triggers the bug by sending malformed network packets to an SIW-enabled service.\nS:U - The vulnerability crashes the kernel, which is within the same security authority. There is no crossing of a security boundary like VM escape.\nC:N - This is a pure NULL pointer dereference (access at offset 0xc0 from NULL). No information disclosure occurs \u2014 the kernel oopses/panics without leaking data.\nI:N - This is a NULL pointer dereference causing a crash. There is no memory corruption, no write primitive, and no code execution \u2014 the access address (0xc0) is not mappable on modern kernels.\nA:H - The NULL pointer dereference causes a kernel oops or panic, crashing the system. This is reliably triggerable by a remote attacker sending malformed iWARP packets."
    }
  }
}